Abnormal communication detection apparatus, abnormal communication detection method and program

Abstract

There is provided an abnormal communication detection apparatus capable of reducing over-detection. The abnormal communication detection apparatus includes: a receiving part receiving communication data for learning that includes an identifier and communication data for detection that includes the identifier; a knowledge information acquiring part acquiring knowledge information that is information about at least either temporal characteristics or payload characteristics of the communication data for learning; an allocation rule generating part generating allocation rules that are rules for specifying which communication data having which identifier is to be allocated to which detector among a plurality of detectors, based on the knowledge information; an allocating part allocating the communication data to any of the detectors based on the allocation rules; and the plurality of detectors each of which learns, when the communication data for learning is allocated, a model for detecting whether the communication data allocated to the detector is normal or abnormal, and detects, when the communication data for detection is allocated, whether the communication data for detection is normal or abnormal based on the learned model.

What is claimed is: 
     
       1. An abnormal communication detection apparatus detecting abnormal communication from communication of each electronic control apparatus in a communication network, the abnormal communication detection apparatus comprising:
 processing circuitry configured to
 receive communication data for learning that includes an identifier and communication data for detection that includes the identifier, 
 acquire knowledge information that is information about at least either temporal characteristics or payload characteristics of the communication data for learning, 
 generate allocation rules under an OR condition that are rules for specifying which communication data having which identifier is to be allocated to which detector among a plurality of detectors, based on the knowledge information, wherein the knowledge information is information used to generate the allocation rules under the OR condition, the OR condition is a condition that does not combine a detection result of one detector with a detection result of another detector and is a condition for judging whether a corresponding operation is normal or abnormal based on a result of detection by only one detector, and the allocation rules under the OR condition are rules for allocating one piece of detection data to only one detector out of the plurality of detectors so as not to combine the detection result of one detector with the detection result of another detector, and 
 allocate the communication data to any of the detectors based on the allocation rules; and 
 the plurality of detectors each of which learns, when the communication data for learning is allocated, a model for detecting whether the communication data allocated to the detector is normal or abnormal, and detects, when the communication data for detection is allocated, whether the communication data for detection is normal or abnormal based on the learned model. 
 
 
     
     
       2. The abnormal communication detection apparatus according to  claim 1 , comprising
 a particular detector group that is a group of detectors having the same performance; wherein 
 the processing circuitry generates the allocation rules so that a total communication amount of the communication data allocated to each of the detectors belonging to the particular detector group per unit time is equal. 
 
     
     
       3. The abnormal communication detection apparatus according to  claim 2 , wherein
 the processing circuitry
 generates the allocation rules so that the communication data is allocated to the plurality of detectors at the same time; 
 aggregates detection results by the plurality of detectors for the communication data; and outputs a final detection result of the communication data based on the aggregated detection results. 
 
 
     
     
       4. The abnormal communication detection apparatus according to  claim 2 , wherein
 the processing circuitry
 generates the allocation rules so that the communication data is allocated to the plurality of detectors at the same time; 
 aggregates detection results by the plurality of detectors for the communication data; and 
 outputs a final detection result of the communication data based on the aggregated detection results. 
 
 
     
     
       5. The abnormal communication detection apparatus according to  claim 1 , wherein
 the processing circuitry
 generates the allocation rules so that the communication data is allocated to the plurality of detectors at the same time; 
 aggregates detection results by the plurality of detectors for the communication data; and 
 outputs a final detection result of the communication data based on the aggregated detection results. 
 
 
     
     
       6. An abnormal communication detection method for detecting abnormal communication from communication of each electronic control apparatus in a communication network, the abnormal communication detection method comprising:
 a receiving step of receiving communication data for learning that includes an identifier and communication data for detection that includes the identifier; 
 a knowledge information acquiring step of acquiring knowledge information that is information about at least either temporal characteristics or payload characteristics of the communication data for learning; 
 an allocation rule generating step of generating allocation rules under an OR condition that are rules for specifying which communication data having which identifier is to be allocated to which detector among a plurality of detectors, based on the knowledge information, wherein the knowledge information is information used to generate the allocation rules under the OR condition, the OR condition is a condition that does not combine a detection result of one detector with a detection result of another detector and is a condition for judging whether a corresponding operation is normal or abnormal based on a result of detection by only one detector, and the allocation rules under the OR condition are rules for allocating one piece of detection data to only one detector out of the plurality of detectors so as not to combine the detection result of one detector with the detection result of another detector; 
 an allocating step of allocating the communication data to any of the detectors based on the allocation rules; 
 a learning step of learning, when the communication data for learning is allocated, a model for detecting whether the communication data allocated to the detector is normal or abnormal; and 
 a detecting step of detecting, when the communication data for detection is allocated, whether the communication data for detection is normal or abnormal based on the learned model. 
 
     
     
       7. The abnormal communication detection method according to  claim 6 , wherein
 the allocation rule generating step generates the allocation rules so that a total communication amount of the communication data allocated to each of detectors belonging to a particular detector group that is a group of detectors having the same performance per unit time is equal. 
 
     
     
       8. The abnormal communication detection method according to  claim 6 , wherein
 the processing circuitry generates the allocation rules so that a total communication amount of the communication data allocated to each of detectors belonging to a particular detector group that is a group of detectors having the same performance per unit time is equal. 
 
     
     
       9. A non-transitory computer readable medium that stores a program causing a computer to function as the abnormal communication detection apparatus according to  claim 1 . 
     
     
       10. A non-transitory computer readable medium that stores a program causing a computer to function as the abnormal communication detection apparatus according to  claim 2 . 
     
     
       11. A non-transitory computer readable medium that stores a program causing a computer to function as the abnormal communication detection apparatus according to  claim 5 . 
     
     
       12. A non-transitory computer readable medium that stores a program causing a computer to function as the abnormal communication detection apparatus according to  claim 3 . 
     
     
       13. A non-transitory computer readable medium that stores a program causing a computer to function as the abnormal communication detection apparatus according to  claim 4 .